verify build provenance

.github/workflows/test.yml

@@ -15,6 +15,9 @@ on:
       - "main"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-linux:
     runs-on: ${{ matrix.os }}
@@ -42,6 +45,8 @@ jobs:
       - run: npm run build
       - run: npm run package
       - run: npm test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - id: setup-perl
         name: use the action
@@ -121,6 +126,8 @@ jobs:
       - run: npm run build
       - run: npm run package
       - run: npm test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - id: setup-perl
         name: use the action
@@ -203,6 +210,8 @@ jobs:
       - run: npm run build
       - run: npm run package
       - run: npm test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - id: setup-perl
         name: use the action

__test__/installer.test.ts

@@ -1,8 +1,9 @@
-import io = require("@actions/io");
-import path = require("path");
-import os = require("os");
-import fs = require("fs");
+import * as io from "@actions/io";
+import * as path from "path";
+import * as os from "os";
+import * as fs from "fs";
 
+const githubToken = process.env["GITHUB_TOKEN"];
 const toolDir = path.join(__dirname, "runner", "tools");
 const tempDir = path.join(__dirname, "runner", "temp");
 // const dataDir = path.join(__dirname, 'data');
@@ -30,7 +31,7 @@ describe("installer tests", () => {
   }, 100000);
 
   it("Acquires version of Perl if no matching version is installed", async () => {
-    await installer.getPerl("5.26.x", false);
+    await installer.getPerl("5.26.x", false, githubToken);
     const perlDir = path.join(toolDir, "perl", "5.26.3", os.arch());
 
     expect(fs.existsSync(`${perlDir}.complete`)).toBe(true);

action.yml

@@ -45,6 +45,11 @@ inputs:
     description: working directory.
     default: "."
     required: false
+  github-token:
+    description: |
+      GitHub token to use for verifying Perl binary.
+    default: "${{ github.token }}"
+    required: false
 outputs:
   perl-version:
     description: |
@@ -55,11 +60,11 @@ outputs:
       It contains useful information to use as the cache key,
       e.g. the platform, the version of perl, the compiler option for building perl.
   cache-hit:
-    description: 'A boolean value to indicate if a cache was hit'
+    description: "A boolean value to indicate if a cache was hit"
 runs:
   using: "node20"
   main: "dist/setup/index.js"
-  post: 'dist/cache-save/index.js'
+  post: "dist/cache-save/index.js"
   post-if: success()
 branding:
   icon: "play"